CVE-2025-23319 is a high severity (CVSS 8.1) out-of-bounds write in the Python backend of NVIDIA Triton Inference Server, which an attacker could trigger by sending a request. It may lead to remote code execution, denial of service, data tampering or information disclosure. NVIDIA lists versions prior to 25.07 as affected.
What's affected
NVIDIA's August 2025 security bulletin for Triton Inference Server, released on 6 August 2025, lists Windows and Linux with a different fixed release depending on the CVE. For this one, all versions prior to 25.07 are affected and 25.07 is the updated version. The vector shows network access, no privileges and high attack complexity. NVIDIA credits Ronen Shustin of WIZ.IO for this report.
The same bulletin lists many other Triton CVEs fixed in releases 25.05, 25.06 and 25.07, so a server older than 25.07 is exposed to several issues at once. The bulletin's notes advise production users to follow the Secure Deployment Considerations Guide.
How to check if you're exposed
Find the Triton release you run. Most deployments use NVIDIA's container images, which carry a YY.MM tag.
docker images | grep -i tritonserver
tritonserver --version
Compare the result with the fixed release for your CVE. Then look at how the server is exposed. The bulletin's notes say production users should follow the Secure Deployment Considerations Guide and make sure logging and shared memory APIs are protected for use by authorized users. Check which networks can reach the HTTP and gRPC ports, and whether those management style APIs are open to anyone.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade Triton Inference Server to 25.07 or later, using the release on the Triton GitHub releases page.
- Rebuild and redeploy any container image that pins an older tag.
- Follow NVIDIA's Secure Deployment Considerations Guide, and make sure logging and shared memory APIs are limited to authorized users.
- Keep the inference ports on a private network or behind an authenticated gateway.
- Review other Triton CVEs in the same bulletin so one upgrade covers them all.
Why it matters
CWE-787 is an out-of-bounds write and CWE-805 is buffer access with an incorrect length value. The bulletin says a request can cause the write in the Python backend. The shared memory used between the server and its Python stub processes is the area the bulletin highlights in its notes.
That note is practical: NVIDIA asks production users to make sure logging and shared memory APIs are protected for use by authorized users. If those are open to anyone who can reach the server, several issues in this bulletin become easier to reach. The KEV flag for this CVE is false and no exploitation is claimed.
Quick check
Does one upgrade fix both Python backend writes?
The bulletin lists CVE-2025-23318 and CVE-2025-23319 under the same fixed release, 25.07.
What setting should I check besides the version?
Whether logging and shared memory APIs are limited to authorized users, as the bulletin's notes advise.
Sources
Last reviewed: 19 October 2026.
